Recover · Coming soon
Incident response and remediation
Structured investigation, containment and recovery when something goes wrong.
When this service is available, it will take a suspected or confirmed incident from intake through investigation, containment, recovery and remediation, with each step authorised by you and verified before it is closed. Facts, hypotheses and unknowns are tracked separately so decisions rest on what is known. This service is not yet available and is not an emergency response commitment: no response time is offered.
Register interest- Price
- Not available yet
- How you can engage us
- One-off project
- Delivered by
- A specialist partner
Who delivers this: Delivery will be through a specialist partner that you explicitly engage for the incident. The partner will be named in the scope before any work starts.
Who it is for
Businesses dealing with a suspected compromise that need a structured investigation and a documented path back to normal operations.
Scope
The incident, systems and authority agreed in writing at intake.
What is included
- Intake: what happened, what is affected and who is involved
- Agreed scope and written authority for every action taken
- Investigation of the affected accounts, devices and systems
- Containment actions you authorise
- Recovery coordination with your IT provider and other suppliers
- Remediation of the weaknesses that allowed the incident
- Verification that containment and remediation worked
- An incident report with facts, hypotheses and unknowns tracked separately
- Technical information to support assessment by your legal advisers and insurer
- A lessons-learned review
What is not included
- Work outside the agreed scope, which is quoted separately
- Emergency or on-call response, or any response time commitment
- Legal advice, including on notification obligations
- Negotiating with attackers, or ransom payment
- Recovering funds lost to fraud
- Expert witness or forensic services for court proceedings
How delivery works
- 01
Intake and authority
We record what is known, agree the scope and get written authority before any action.
- 02
Investigate
The investigation separates confirmed facts from hypotheses and unknowns, and decides what to contain first.
- 03
Contain and recover
Authorised containment and recovery actions are taken and coordinated with your IT provider.
- 04
Verify and remediate
We check containment held, fix the weaknesses that allowed the incident, and verify each fix.
- 05
Report and learn
We deliver the incident report and run a lessons-learned review.
Who does what
You
- Authorise the scope and each containment or recovery action in writing
- Notify your insurer as your policy requires and engage legal advisers where needed
- Provide access and information promptly
- Make decisions on business trade-offs during containment and recovery
Cyber Guys
- Run intake and keep the authority record
- Coordinate the specialist partner, your IT provider and other suppliers
- Track facts, hypotheses and unknowns separately
- Verify containment and remediation before closing
- Deliver the incident report and lessons-learned review
Specialist partner
- The specialist partner named in the scope performs investigation and technical response within the written authority
- Your IT provider carries out or supports recovery on systems they manage
Access we need
- Administrator access to affected systems, granted for the engagement
- Access to logs, alerts and backup consoles relevant to the incident
We never ask for your password. Access is through a named account that you or your IT provider create for the engagement, and can remove at any time.
Dependencies and licences
- Investigation depth depends on the logs and evidence available, which depends on your licences and log retention
- Your insurer may require a particular incident response provider; check your policy before engaging
What you receive
- Authority and action log
- Incident report with facts, hypotheses and unknowns
- Remediation record with verification results
- Lessons-learned review
How we know it is finished
- Containment is verified and authorised remediation is complete or recorded with an owner
- The incident report and lessons-learned review are delivered
Related services
Incident preparedness
Know who does what before something goes wrong.
Quoted on scopeRequest a quoteBackup and recovery readiness
Know you can get your business back, not just that backups ran.
Quoted on scopeRequest a quoteManaged endpoint and identity protection
Coming soonProtection on your devices and accounts, with alerts handled.
Register interest
Register interest in Incident response and remediation
This service is not available yet. Leave your details and we will let you know when it is. Nothing is ordered.